All release notes
Windows Agent
Behavioural signals and attack-chain correlation
Next-generation Secuno agent. The collection and detection engine has been rebuilt around structured behavioural signals, adding process anomaly classification, Windows security event-log sampling, active-connection analysis, deeper persistence and scheduled-task inspection, fleet-wide baselining, and new endpoint compliance checks for password age and screen lock. It also reports Windows update state and can install approved patches.
New
- Process collection with on-device anomaly classification: each process is captured with its image path, command line, owner, integrity level and signing status, and only anomalous processes are reported. Checks include system binaries running from the wrong path (masquerade), execution from user-writable locations, dangerous parent-to-child chains such as Office or a browser launching a script host, and suspicious or encoded command lines.
- Windows security event-log sampling: per heartbeat the agent reads failed and explicit-credential logon events, security-log-cleared events and new-service installations, aggregating counts and capped value lists. These feed the platform's credential-attack, credential-abuse, evidence-tampering and suspicious-service investigations.
- Active connection analysis: established outbound TCP connections are enumerated and suspicious traffic is classified (lateral movement over SMB, RDP and WinRM, living-off-the-land beacons and known command-and-control ports), giving real device-to-device evidence for lateral-movement investigations.
- Scheduled-task content: tasks are now captured with their action binary and arguments, trigger type, run-as account and signing status, not just name and state.
- Extended persistence collection: image-file-execution-options debuggers, AppInit DLLs, Winlogon, LSA packages and print monitors are collected in addition to Run keys, and WMI event-subscription persistence is captured to close the fileless persistence blind spot.
- Password-age and screen-lock posture: local accounts' last-password-set and never-expires state and the machine inactivity / screen-saver lock timeout are collected and feed new device compliance checks (a password older than 90 days or set never to expire, and an idle lock beyond the 15-minute baseline).
Improved
- Fleet baselining: endpoint state is compared against what is normal across the client's fleet so first-time or unusual configurations can be flagged.
- Windows update reporting and installation: the agent reports missing and installed updates so the patch catalogue fills itself, and installs approved patches with real deployment-state feedback.